Commit Graph

4956 Commits

Author SHA1 Message Date
Dan Walsh
13b7212ad0 add openstack swift domain 2013-02-04 17:03:20 -05:00
Dan Walsh
330d3c0f25 add openshift_cron_t as a permissive domain 2013-02-01 13:36:46 -05:00
Dan Walsh
32922067ef Add systemd_sysctl_t as a permissive domain 2013-01-31 10:30:03 -05:00
Miroslav Grepl
f125066d3c * Wed Jan 30 2013 Miroslav Grepl <mgrepl@redhat.com> 3.12.1-9
- boinc_cliean wants also execmem as boinc projecs have
- Allow sa-update to search admin home for /root/.spamassassin
- Allow sa-update to search admin home for /root/.spamassassin
- Allow antivirus domain to read net sysctl
- Dontaudit attempts from thumb_t to connect to ssd
- Dontaudit attempts by readahead to read sock_files
- Dontaudit attempts by readahead to read sock_files
- Create tmpfs file while running as wine as user_tmpfs_t
- Dontaudit attempts by readahead to read sock_files
- libmpg ships badly created librarie
2013-01-30 12:41:36 +01:00
Dan Walsh
45852f5fe5 Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy
Conflicts:
	selinux-policy.spec
2013-01-28 15:39:02 -05:00
Dan Walsh
b59d07ae28 Do a better job of cleaning up old policy files, trigger relabel of /home on upgrade to F19 2013-01-28 15:36:16 -05:00
Miroslav Grepl
aab1932f46 - Change ssh_use_pts to use macro and only inherited sshd_devpts_t
- Allow confined users to read systemd_logind seat information
- libmpg ships badly created libraries
- Add support for strongswan.service
- Add labeling for strongswan
- Allow l2tpd_t to read network manager content in /run directory
- Allow rsync to getattr any file in rsync_data_t
- Add labeling and filename transition for .grl-podcasts
2013-01-28 20:11:03 +01:00
Miroslav Grepl
a39c31a810 Fix dupl transition rules in mozilla.te 2013-01-25 20:24:52 +01:00
Miroslav Grepl
1802bef984 * Fri Jan 25 2013 Miroslav Grepl <mgrepl@redhat.com> 3.12.1-7
- mount.glusterfs executes glusterfsd binary
- Allow systemd_hostnamed_t to stream connect to systemd
- Dontaudit any user doing a access check
- Allow obex-data-server to request the kernel to load a modul
- Allow gpg-agent to manage gnome content (~/.cache/gpg-agent-
- Allow gpg-agent to read /proc/sys/crypto/fips_enabled
- Add new types for antivirus.pp policy module
- Allow gnomesystemmm_t caps because of ioprio_set
- Make sure if mozilla_plugin creates files while in permissiv
- Allow gnomesystemmm_t caps because of ioprio_set
- Allow NM rawip socket
- files_relabel_non_security_files can not be used with boolea
- Add interface to thumb_t dbus_chat to allow it to read remot
- ALlow logrotate to domtrans to mdadm_t
- kde gnomeclock wants to write content to /tmp
2013-01-25 14:24:33 +01:00
Miroslav Grepl
4c3676d47a clamav and amavis has been merge to antivirus policy 2013-01-25 14:17:56 +01:00
Miroslav Grepl
b591902d83 * Wed Jan 23 2013 Miroslav Grepl <mgrepl@redhat.com> 3.12.1-6
- kde gnomeclock wants to write content to /tmp
- /usr/libexec/kde4/kcmdatetimehelper attempts to create /root/.kde
- Allow blueman_t to rwx zero_device_t, for some kind of jre
- Allow mozilla_plugin_t to rwx zero_device_t, for some kind of jre
- Ftp full access should be allowed to create directories as well as files
- Add boolean to allow rsync_full_acces, so that an rsync server can write all
- over the local machine
- logrotate needs to rotate logs in openshift directories, needs back port to RHEL6
- Add missing vpnc_roles type line
- Allow stapserver to write content in /tmp
- Allow gnome keyring to create keyrings dir in ~/.local/share
- Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on
- Add interface to colord_t dbus_chat to allow it to read remote process state
- Allow colord_t to read cupsd_t state
- Add mate-thumbnail-font as thumnailer
- Allow sectoolm to sys_ptrace since it is looking at other proceses /proc data.
- Allow qpidd to list /tmp. Needed by ssl
- Only allow init_t to transition to rsync_t domain, not initrc_t.  This should be b
- - Added systemd support for ksmtuned
- Added booleans
       ksmtuned_use_nfs
       ksmtuned_use_cifs
- firewalld seems to be creating mmap files which it needs to execute in /run /tmp a
- Looks like qpidd_t needs to read /dev/random
- Lots of probing avc's caused by execugting gpg from staff_t
- Dontaudit senmail triggering a net_admin avc
- Change thumb_role to use thumb_run, not sure why we have a thumb_role, needs back
- Logwatch does access check on mdadm binary
- Add raid_access_check_mdadm() iterface
2013-01-23 12:22:19 +01:00
Dan Walsh
a09a7deb16 Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy 2013-01-16 09:46:42 -05:00
Dan Walsh
6d40a6c274 Add selinux-policy-filesystem for /etc/selinux directory so it can be shared with libsemanage 2013-01-16 09:46:31 -05:00
Miroslav Grepl
207a4dfc95 - Fix systemd_manage_unit_symlinks() interface
- Call systemd_manage_unit_symlinks(() which is correct interface
- Add filename transition for opasswd
- Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we hav
- Allow sytstemd-timedated to get status of init_t
- Add new systemd policies for hostnamed and rename gnomeclock_t to syste
- colord needs to communicate with systemd and systemd_logind, also remov
- Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we hav
- Allow gpg_t to manage all gnome files
- Stop using pcscd_read_pub_files
- New rules for xguest, dontaudit attempts to dbus chat
- Allow firewalld to create its mmap files in tmpfs and tmp directories
- Allow firewalld to create its mmap files in tmpfs and tmp directories
- run unbound-chkconf as named_t, so it can read dnssec
- Colord is reading xdm process state, probably reads state of any apps t
- Allow mdadm_t to change the kernel scheduler
- mythtv policy
- Update mandb_admin() interface
- Allow dsspam to listen on own tpc_socket
2013-01-16 15:13:43 +01:00
Dan Walsh
5f2806ad4e Rename gnomeclock to systemd_timedated 2013-01-15 18:58:56 -05:00
Dan Walsh
c14302d03d Rename gnomeclock to systemd_timedated 2013-01-15 18:54:56 -05:00
Dan Walsh
7846a149ab Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy 2013-01-15 11:56:41 -05:00
Dan Walsh
0608169181 Update from upstream 2013-01-15 11:55:13 -05:00
Dan Walsh
afbf138ed9 Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy
Conflicts:
	selinux-policy.spec
2013-01-15 11:54:07 -05:00
Miroslav Grepl
7f090dbfaa * Mon Jan 14 2013 Miroslav Grepl <mgrepl@redhat.com> 3.12.1-4
- Allow systemd-tmpfiles to relabel lpd spool files
- Ad labeling for texlive bash scripts
- Add xserver_filetrans_fonts_cache_home_content() interface
- Remove duplicate rules from *.te
- Add support for /var/lock/man-db.lock
- Add support for /var/tmp/abrt(/.*)?
- Add additional labeling for munin cgi scripts
- Allow httpd_t to read munin conf files
- Allow certwatch to read meminfo
- Fix nscd_dontaudit_write_sock_file() interfac
- Fix gnome_filetrans_home_content() to include also "fontconfig" dir as cache_home_t
- llow mozilla_plugin_t to create HOMEDIR/.fontconfig with the proper labeling
2013-01-14 13:39:59 +01:00
Miroslav Grepl
9e49f866d4 More fixes for numad 2013-01-11 22:04:24 +01:00
Miroslav Grepl
a3277735dd Fix virt_ptrace() interface
Please enter the commit message for your changes. Lines starting
2013-01-11 20:01:16 +01:00
Miroslav Grepl
a765f30a9f fix consolekit 2013-01-11 19:48:49 +01:00
Miroslav Grepl
a7dce2ac5c * Fri Jan 11 2013 Miroslav Grepl <mgrepl@redhat.com> 3.12.1-3
- Allow gnomeclock to talk to puppet over dbus
- Allow numad access discovered by Dominic
- Add support for HOME_DIR/.maildir
- Fix attribute_role for mozilla_plugin_t domain to allow staff_r to access this d
- Allow udev to relabel udev_var_run_t lnk_files
- New bin_t file in mcelog
2013-01-11 19:30:57 +01:00
Miroslav Grepl
0c265c3817 Add back consolekit but we keep just consolekit.te and .fc was commented 2013-01-11 14:33:08 +01:00
Miroslav Grepl
f851aec1c4 - Remove all mcs overrides and replace with t1 != mcs_constrained_ty
- Add attribute_role for iptables
- mcs_process_set_categories needs to be called for type
- Implement additional role_attribute statements
- Sodo domain is attempting to get the additributes of proc_kcore_t
- Unbound uses port 8953
- Allow svirt_t images to compromise_kernel when using pci-passthrou
- Add label for dns lib files
- Bluetooth aquires a dbus name
- Remove redundant files_read_usr_file calling
- Remove redundant files_read_etc_file calling
- Fix mozilla_run_plugin()
- Add role_attribute support for more domains
2013-01-10 17:31:42 +01:00
Miroslav Grepl
fa970c32f1 use policy.29 2013-01-09 14:52:41 +01:00
Miroslav Grepl
8f47af1bde Require POLICYCOREUTILSVER 2.1.13-53 2013-01-09 14:52:16 +01:00
Miroslav Grepl
23a9442e40 * Wed Jan 9 2013 Miroslav Grepl <mgrepl@redhat.com> 3.12.1-1
- Mass merge with upstream
2013-01-09 13:16:35 +01:00
Miroslav Grepl
e5e41801b0 Upload new upstream sources 2013-01-08 11:50:45 +01:00
Miroslav Grepl
9cdcf52c73 Bump POLICYVER 2013-01-07 17:43:07 +01:00
Miroslav Grepl
fdeb413467 Revert "Upstream uses ctdb instead of ctdbd policy"
This reverts commit 1871109735.
2013-01-07 14:54:40 +01:00
Miroslav Grepl
c57639b449 Revert "Upstream change:"
This reverts commit 098e5a0968.
2013-01-07 14:54:27 +01:00
Miroslav Grepl
1a1e004154 Revert "Upstream change:"
This reverts commit 7316889d21.
2013-01-07 14:54:15 +01:00
Miroslav Grepl
6e9f07d2e3 Revert "Upstream change:"
This reverts commit 0368b4c345.
2013-01-07 14:54:04 +01:00
Dan Walsh
3ba95111e0 Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy 2013-01-07 08:44:03 -05:00
Dan Walsh
4ee59fd5e7 Bump the policy version to 28 to match selinux userspace
- Rebuild versus latest libsepol
2013-01-07 08:42:53 -05:00
Miroslav Grepl
0368b4c345 Upstream change:
-isnsd = module
+isns = module
2013-01-07 14:32:26 +01:00
Miroslav Grepl
7316889d21 Upstream change:
-glusterd =  module
+glusterfs =  module
2013-01-07 12:43:02 +01:00
Miroslav Grepl
098e5a0968 Upstream change:
-fcoemon = module
+fcoe = module
2013-01-07 09:44:43 +01:00
Miroslav Grepl
1871109735 Upstream uses ctdb instead of ctdbd policy 2013-01-07 00:11:42 +01:00
Dan Walsh
01be266ba7 Bump the policy version to 28 to match selinux userspace
- Rebuild versus latest libsepol
2013-01-06 10:35:25 -05:00
Dan Walsh
bd7833f997 Fresh start on permissive domains for F19 2013-01-05 07:12:20 -05:00
Miroslav Grepl
17da016672 * Wed Jan 2 2013 Miroslav Grepl <mgrepl@redhat.com> 3.11.1-69
- Add systemd_status_all_unit_files() interface
- Add support for nshadow
- Allow sysadm_t to administrate the postfix domains
- Add interface to setattr on isid directories for use by tmpreaper
- Allow sshd_t sys_admin for use with afs logins
- Allow systemd to read/write all sysctls
- Allow sshd_t sys_admin for use with afs logins
- Allow systemd to read/write all sysctls
- Add systemd_status_all_unit_files() interface
- Add support for nshadow
- Allow sysadm_t to administrate the postfix domains
- Add interface to setattr on isid directories for use by tmpreaper
- Allow sshd_t sys_admin for use with afs logins
- Allow systemd to read/write all sysctls
- Allow sshd_t sys_admin for use with afs logins
- Add labeling for /var/named/chroot/etc/localtim

* Thu Dec 27 2012 Miroslav Grepl <mgrepl@redhat.com> 3.11.1-68
- Allow setroubleshoot_fixit to execute rpm
- zoneminder needs to connect to httpd ports where remote cameras are listening
- Allow firewalld to execute content created in /run directory
- Allow svirt_t to read generic certs
- Dontaudit leaked ps content to mozilla plugin
- Allow sshd_t sys_admin for use with afs logins
- Allow systemd to read/write all sysctls
- init scripts are creating systemd_unit_file_t directories
2013-01-02 15:52:27 +01:00
Miroslav Grepl
eb0fd25a19 renamed: policy-rawhide.patch -> policy-rawhide-base.patch
renamed:    policy_contrib-rawhide.patch -> policy-rawhide-contrib.patch
2013-01-02 15:50:45 +01:00
Miroslav Grepl
52491466e2 Backport policy from F18 2012-12-21 09:57:21 +01:00
Miroslav Grepl
003088b3f0 Add modules-*.conf files 2012-12-17 17:22:13 +01:00
Miroslav Grepl
a270091f19 Make rawhide == f18 2012-12-17 17:21:00 +01:00
rhatdan
5991fc8049 Make sure content created in the homedir by uncnfined domains get created with the corect label. specifically /.readahead 2012-08-08 11:20:07 -04:00
Miroslav Grepl
e88478c88d +* Tue Aug 7 2012 Miroslav Grepl <mgrepl@redhat.com> 3.11.1-3
+- Add role rules for realmd, sambagui
2012-08-07 17:16:15 +02:00